CVE-2024-37280
Fixed in a distro release EPSS <1%CVSS 4.9
A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.
Products: Elasticsearch
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 8.14.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | elasticsearch-8 | 8.14.1-r0 |
| Chainguard | elasticsearch-8-bitnami | 8.14.1-r0 |
| Chainguard | elasticsearch-8-config | 8.14.1-r0 |
| Chainguard | elasticsearch-8-iamguarded | 8.14.1-r0 |
| Chainguard | elasticsearch-config | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8 | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8-bitnami | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8-config | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8-policy-140-2 | 8.14.1-r0 |
| Chainguard | elasticsearch-fips-8-policy-140-3 | 8.14.1-r0 |
| Chainguard | sonarqube | 25.10.0.114319-r0 |
| Chainguard | sonarqube-10 | 25.3.0.104237-r0 |
| Chainguard | sonarqube-10-docker-compat | 25.3.0.104237-r0 |
| Chainguard | sonarqube-10-scripts | 25.3.0.104237-r0 |
| Chainguard | sonarqube-docker-compat | 25.10.0.114319-r0 |
| Chainguard | sonarqube-scripts | 25.10.0.114319-r0 |
| Ubuntu 16.04 LTS | elasticsearch | no fix |
| Wolfi | sonarqube | 25.10.0.114319-r0 |
| Wolfi | sonarqube-10 | 25.3.0.104237-r0 |
| Wolfi | sonarqube-10-docker-compat | 25.3.0.104237-r0 |
| Wolfi | sonarqube-10-scripts | 25.3.0.104237-r0 |
| Wolfi | sonarqube-docker-compat | 25.10.0.114319-r0 |
| Wolfi | sonarqube-scripts | 25.10.0.114319-r0 |